CVE-2026-64916: Microsoft SharePoint Server XSS Vulnerability

CVE-2026-64916 Overview

CVE-2026-64916 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw stems from improper neutralization of input during web page generation [CWE-79]. An authorized attacker can inject malicious script content that executes in the context of other users' browsers, enabling spoofing attacks over a network.

The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Exploitation requires low-level privileges and user interaction, but the scope changes when script execution crosses trust boundaries within the SharePoint site.

Critical Impact
Successful exploitation allows an authenticated attacker to execute arbitrary script in a victim's browser session, enabling content spoofing, session context manipulation, and limited disclosure of information rendered within the SharePoint interface.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-64916 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-64916

Vulnerability Analysis

The vulnerability resides in SharePoint Server's web page generation logic, where user-supplied content is rendered without adequate output encoding. When an authenticated user with contribution privileges submits crafted input containing script payloads, SharePoint stores the content and later serves it to other users without proper sanitization.

Because the injected script executes within the SharePoint origin, it inherits the trust and session context of the viewing user. The attacker can manipulate rendered page content, forge UI elements, and read data accessible to the victim within the same site collection.

The scope-changed nature of the flaw indicates that script execution crosses a security boundary. Payloads delivered through one SharePoint component can act on resources controlled by a different security authority, amplifying the spoofing impact beyond the attacker's own privilege level.

Root Cause

SharePoint fails to consistently apply HTML entity encoding or context-aware output escaping when rendering attacker-controlled fields. This is a classic instance of improper neutralization of input during web page generation, tracked under [CWE-79].

Attack Vector

An attacker with authenticated access and permission to submit content (such as list items, document metadata, or web part configuration) injects a crafted payload. When a targeted user loads the affected page, the browser parses the payload as executable script rather than as inert text, triggering the spoofing behavior.

The vulnerability is exploitable over a network, requires user interaction from the victim, and does not require elevated administrative privileges on the SharePoint server. Public proof-of-concept code is not currently available.

Detection Methods for CVE-2026-64916

Indicators of Compromise

SharePoint list items, document properties, or web part fields containing HTML <script> tags, javascript: URIs, or encoded event handlers such as onerror, onload, or onmouseover.
Unexpected outbound HTTP requests from user browsers to attacker-controlled domains immediately after loading a SharePoint page.
IIS logs showing repeated POST requests to SharePoint content endpoints from a single low-privileged account with payloads containing angle brackets or URL-encoded script fragments.

Detection Strategies

Inspect SharePoint content databases and audit logs for stored fields containing HTML tags in properties that should hold plain text.
Deploy Content Security Policy (CSP) violation reporting to identify inline script execution attempts against the SharePoint origin.
Correlate authenticated user activity with anomalous DOM modification patterns using browser-based telemetry or endpoint detection tooling.

Monitoring Recommendations

Enable SharePoint auditing for item modifications and monitor for entries containing suspicious markup patterns.
Alert on account behavior anomalies where standard contributors suddenly modify high-visibility pages or lists accessed by administrators.
Track referrer chains and session tokens for signs of session context abuse originating from SharePoint pages.

How to Mitigate CVE-2026-64916

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Response Center advisory for CVE-2026-64916 to all affected SharePoint Server deployments.
Audit SharePoint sites for user-submitted content containing HTML or script markup and remove suspicious entries.
Review contributor and author permissions across site collections and remove unnecessary write access.

Patch Information

Microsoft has published a security update addressing CVE-2026-64916. Administrators should consult the Microsoft Security Update guidance for the applicable patch package for SharePoint Server Subscription Edition, 2019, and 2016. Apply the update through standard SharePoint patching procedures, including running the SharePoint Products Configuration Wizard on all farm servers.

Workarounds

Restrict content contribution permissions to trusted user groups until patching is complete.
Deploy a strict Content Security Policy header at the reverse proxy or IIS layer to block inline script execution on SharePoint responses.
Enable SharePoint's HTML field security settings to strip active markup from user-submitted content where feasible.

bash

# Example: enforce Content Security Policy at IIS for SharePoint web application
Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/SharePoint - 80' `
  -filter 'system.webServer/httpProtocol/customHeaders' -name '.' `
  -value @{name='Content-Security-Policy'; value="default-src 'self'; script-src 'self'; object-src 'none'"}